On Sun, Feb 6, 2022 at 5:41 AM Hengqi Chen <hengqi.chen@xxxxxxxxx> wrote:
>
> Add syscall-specific variant of BPF_KPROBE named BPF_KPROBE_SYSCALL ([0]).
> The new macro hides the underlying way of getting syscall input arguments.
> With these new macros, the following code:
>
> SEC("kprobe/__x64_sys_close")
> int BPF_KPROBE(do_sys_close, struct pt_regs *regs)
> {
> int fd;
>
> fd = PT_REGS_PARM1_CORE(regs);
> /* do something with fd */
> }
>
> can be written as:
>
> SEC("kprobe/__x64_sys_close")
> int BPF_KPROBE_SYSCALL(do_sys_close, int fd)
> {
> /* do something with fd */
> }
>
> [0] Closes: https://github.com/libbpf/libbpf/issues/425
>
> Signed-off-by: Hengqi Chen <hengqi.chen@xxxxxxxxx>
> ---
> tools/lib/bpf/bpf_tracing.h | 39 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 39 insertions(+)
>
> diff --git a/tools/lib/bpf/bpf_tracing.h b/tools/lib/bpf/bpf_tracing.h
> index cf980e54d331..a0b230320335 100644
> --- a/tools/lib/bpf/bpf_tracing.h
> +++ b/tools/lib/bpf/bpf_tracing.h
> @@ -461,4 +461,43 @@ typeof(name(0)) name(struct pt_regs *ctx) \
> } \
> static __always_inline typeof(name(0)) ____##name(struct pt_regs *ctx, ##args)
>
> +#define ___bpf_syscall_args0() ctx
> +#define ___bpf_syscall_args1(x) \
> + ___bpf_syscall_args0(), (void *)PT_REGS_PARM1_CORE_SYSCALL(regs)
> +#define ___bpf_syscall_args2(x, args...) \
> + ___bpf_syscall_args1(args), (void *)PT_REGS_PARM2_CORE_SYSCALL(regs)
> +#define ___bpf_syscall_args3(x, args...) \
> + ___bpf_syscall_args2(args), (void *)PT_REGS_PARM3_CORE_SYSCALL(regs)
> +#define ___bpf_syscall_args4(x, args...) \
> + ___bpf_syscall_args3(args), (void *)PT_REGS_PARM4_CORE_SYSCALL(regs)
> +#define ___bpf_syscall_args5(x, args...) \
> + ___bpf_syscall_args4(args), (void *)PT_REGS_PARM5_CORE_SYSCALL(regs)
> +#define ___bpf_syscall_args(args...) \
> + ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
> +
please keep each #define on a single line, it's much easier to follow
(and validate) the pattern that way
> +/*
> + * BPF_KPROBE_SYSCALL is a variant of BPF_KPROBE, which is intended for
> + * tracing syscall functions, like __x64_sys_close. It hides the underlying
> + * platform-specific low-level way of getting syscall input arguments from
> + * struct pt_regs, and provides a familiar typed and named function arguments
> + * syntax and semantics of accessing syscall input parameters.
> + *
> + * Original struct pt_regs* context is preserved as 'ctx' argument. This might
> + * be necessary when using BPF helpers like bpf_perf_event_output().
> + */
> +#define BPF_KPROBE_SYSCALL(name, args...) \
> +name(struct pt_regs *ctx); \
> +static __attribute__((always_inline)) typeof(name(0)) \
> +____##name(struct pt_regs *ctx, ##args); \
> +typeof(name(0)) name(struct pt_regs *ctx) \
> +{ \
> + struct pt_regs *regs = (void *)PT_REGS_PARM1(ctx); \
See recent Ilya's patch set ([0]), not all architectures need this
unwrapping. We've abstracted this into PT_REGS_SYSCALL() macro, please
use it here.
[0] https://patchwork.kernel.org/project/netdevbpf/list/?series=611184&state=*
> + _Pragma("GCC diagnostic push") \
> + _Pragma("GCC diagnostic ignored \"-Wint-conversion\"") \
> + return ____##name(___bpf_syscall_args(args)); \
> + _Pragma("GCC diagnostic pop") \
> +} \
> +static __attribute__((always_inline)) typeof(name(0)) \
> +____##name(struct pt_regs *ctx, ##args)
> +
> #endif
> --
> 2.30.2
